ci: build and push operator image on PRs targeting main

.github/PULL_REQUEST_TEMPLATE.md

@@ -25,23 +25,15 @@ che-operator Development Guide: https://github.com/eclipse-che/che-operator/#dev
 
 #### OpenShift
 ```bash
-./build/scripts/olm/test-catalog-from-sources.sh
-```
-
-or
+oc create namespace devworkspace-controller
+oc apply --server-side -f https://raw.githubusercontent.com/devfile/devworkspace-operator/refs/heads/main/deploy/deployment/openshift/combined.yaml
 
-```bash
-build/scripts/docker-run.sh /bin/bash -c "
-  oc login \
-    --token=<...> \
-    --server=<...> \
-    --insecure-skip-tls-verify=true && \
-  build/scripts/olm/test-catalog-from-sources.sh
-"
+OPERATOR_IMAGE=<...>
+sed 's|quay.io/eclipse/che-operator:next|'${OPERATOR_IMAGE}'|g' deploy/deployment/openshift/combined.yaml | oc apply --server-side -f  -
+oc apply --server-side -f deploy/deployment/openshift/org_v2_checluster.yaml
+oc wait checluster eclipse-che -n eclipse-che --for=jsonpath='.status.chePhase'=Active   --timeout=120s
 ```
 
-2. 
-
 #### on Minikube
 
 ```bash

.github/workflows/pr-check.yml

@@ -12,6 +12,8 @@
 
 name: PR check
 on: pull_request
+permissions:
+  contents: read
 jobs:
   unit-tests:
     runs-on: ubuntu-24.04
@@ -24,24 +26,6 @@ jobs:
         go-version: 1.26.5
     - name: Run unit tests
       run: make test
-  multiplatform-image-build:
-    strategy:
-      fail-fast: false
-      matrix:
-        runners: ['ubuntu-24.04', 'ubuntu-24.04-arm']
-    runs-on: ${{matrix.runners}}
-    steps:
-    - name: Checkout source code
-      uses: actions/checkout@v4
-    - name: Set arch environment variable
-      run: |
-        if [[ ${{matrix.runners}} == 'ubuntu-24.04' ]]; then
-          echo arch="amd64" >> $GITHUB_ENV
-        else
-          echo arch="arm64" >> $GITHUB_ENV
-        fi
-    - name: Build image
-      run: docker buildx build --platform linux/${{env.arch}} .
   source-code-validation:
     runs-on: ubuntu-24.04
     steps:

.github/workflows/pr-image-build.yml

@@ -0,0 +1,88 @@
+#
+# Copyright (c) 2019-2026 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+name: PR Image Build
+on: pull_request
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  image-build-amd64:
+    runs-on: ubuntu-24.04
+    if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' }}
+    env:
+      IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-amd64
+      ORGANIZATION: quay.io/eclipse
+    steps:
+    - name: Checkout source code
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Login to quay.io
+      uses: docker/login-action@v3
+      with:
+        registry: quay.io
+        username: ${{ secrets.QUAY_USERNAME }}
+        password: ${{ secrets.QUAY_PASSWORD }}
+    - name: Build and push amd64 image
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile
+        platforms: linux/amd64
+        push: true
+        provenance: false
+        tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}
+    - name: Comment with image name
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const { issue: { number: issue_number }, repo: { owner, repo } } = context;
+          const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}";
+          github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` });
+  image-build-arm64:
+    runs-on: ubuntu-24.04-arm
+    if: ${{ github.event.pull_request.base.ref == 'main' && github.event.pull_request.user.login != 'dependabot[bot]' }}
+    env:
+      IMAGE_VERSION: pr-${{ github.event.pull_request.number }}-arm64
+      ORGANIZATION: quay.io/eclipse
+    steps:
+    - name: Checkout source code
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ github.event.pull_request.head.sha }}
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Login to quay.io
+      uses: docker/login-action@v3
+      with:
+        registry: quay.io
+        username: ${{ secrets.QUAY_USERNAME }}
+        password: ${{ secrets.QUAY_PASSWORD }}
+    - name: Build and push arm64 image
+      uses: docker/build-push-action@v6
+      with:
+        context: .
+        file: ./Dockerfile
+        platforms: linux/arm64
+        push: true
+        provenance: false
+        tags: ${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}
+    - name: Comment with image name
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const { issue: { number: issue_number }, repo: { owner, repo } } = context;
+          const operatorImage = "${{ env.ORGANIZATION }}/che-operator:${{ env.IMAGE_VERSION }}";
+          github.rest.issues.createComment({ issue_number, owner, repo, body: `New operator image available: ${operatorImage}` });

Makefile

@@ -21,12 +21,14 @@ else
 	K8S_CLI := oc
 endif
 
-# Detect image tool
+# Detect image tool: prefer docker, fall back to podman
 ifeq ($(IMAGE_TOOL),)
-ifneq (,$(shell which docker))
+ifneq (,$(shell command -v docker 2>/dev/null))
 	IMAGE_TOOL := docker
-else
+else ifneq (,$(shell command -v podman 2>/dev/null))
 	IMAGE_TOOL := podman
+else
+	$(warning Neither docker nor podman found in PATH; set IMAGE_TOOL=<tool> to run image-related targets)
 endif
 endif
 

bundle/next/eclipse-che/manifests/che-operator.clusterserviceversion.yaml

@@ -86,7 +86,7 @@ metadata:
     categories: Developer Tools
     certified: "false"
     containerImage: quay.io/eclipse/che-operator:next
-    createdAt: "2026-08-19T17:44:00Z"
+    createdAt: "2026-08-24T13:35:51Z"
     description: A Kube-native development solution that delivers portable and collaborative
       developer workspaces.
     features.operators.openshift.io/cnf: "false"
@@ -108,7 +108,7 @@ metadata:
     operatorframework.io/arch.amd64: supported
     operatorframework.io/arch.arm64: supported
     operatorframework.io/os.linux: supported
-  name: eclipse-che.v7.122.0-1058.next
+  name: eclipse-che.v7.122.0-1062.next
   namespace: placeholder
 spec:
   apiservicedefinitions: {}
@@ -1173,7 +1173,7 @@ spec:
       name: openvsx
     - image: quay.io/sclorg/postgresql-16-c9s:20260319
       name: openvsx-postgres
-  version: 7.122.0-1058.next
+  version: 7.122.0-1062.next
   webhookdefinitions:
     - admissionReviewVersions:
         - v1

config/kubernetes/kustomization.yaml

@@ -22,7 +22,7 @@ resources:
 patchesStrategicMerge:
   - patches/cainjection_in_checlusters.yaml
   - patches/cainjection_in_webhook.yaml
-  - patches/service_cert_patch.yaml
+  - patches/deployment_cert_patch.yaml
   - patches/manager_pod_security_context.yaml
 
 vars:

config/openshift/kustomization.yaml

@@ -20,4 +20,5 @@ resources:
 patchesStrategicMerge:
   - patches/cainjection_in_checlusters.yaml
   - patches/cainjection_in_webhook.yaml
+  - patches/deployment_cert_patch.yaml
   - patches/service_cert_patch.yaml

config/openshift/patches/deployment_cert_patch.yaml

@@ -0,0 +1,31 @@
+#
+# Copyright (c) 2019-2026 Red Hat, Inc.
+# This program and the accompanying materials are made
+# available under the terms of the Eclipse Public License 2.0
+# which is available at https://www.eclipse.org/legal/epl-2.0/
+#
+# SPDX-License-Identifier: EPL-2.0
+#
+# Contributors:
+#   Red Hat, Inc. - initial API and implementation
+#
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: che-operator
+  namespace: eclipse-che
+spec:
+  template:
+    spec:
+      containers:
+        - name: che-operator
+          volumeMounts:
+            - mountPath: /tmp/k8s-webhook-server/serving-certs
+              name: webhook-tls-certs
+              readOnly: true
+      volumes:
+        - name: webhook-tls-certs
+          secret:
+            defaultMode: 420
+            secretName: che-operator-service-cert

deploy/deployment/openshift/combined.yaml

@@ -29044,12 +29044,21 @@ spec:
             - ALL
           privileged: false
           readOnlyRootFilesystem: false
+        volumeMounts:
+        - mountPath: /tmp/k8s-webhook-server/serving-certs
+          name: webhook-tls-certs
+          readOnly: true
       hostIPC: false
       hostNetwork: false
       hostPID: false
       restartPolicy: Always
       serviceAccountName: che-operator
       terminationGracePeriodSeconds: 20
+      volumes:
+      - name: webhook-tls-certs
+        secret:
+          defaultMode: 420
+          secretName: che-operator-service-cert
 ---
 apiVersion: admissionregistration.k8s.io/v1
 kind: MutatingWebhookConfiguration

deploy/deployment/openshift/objects/che-operator.Deployment.yaml

@@ -151,9 +151,18 @@ spec:
             - ALL
           privileged: false
           readOnlyRootFilesystem: false
+        volumeMounts:
+        - mountPath: /tmp/k8s-webhook-server/serving-certs
+          name: webhook-tls-certs
+          readOnly: true
       hostIPC: false
       hostNetwork: false
       hostPID: false
       restartPolicy: Always
       serviceAccountName: che-operator
       terminationGracePeriodSeconds: 20
+      volumes:
+      - name: webhook-tls-certs
+        secret:
+          defaultMode: 420
+          secretName: che-operator-service-cert